Integrate HAProxy EventTracker v8.x and above

Publication Date: July 20, 2017

1

Integrate HAProxy

Abstract This guide provides instructions to configure HAProxy to send the syslog to EventTracker Enterprise. Once syslog is configured to send to EventTracker Manager, alerts and reports can be configured into EventTracker.

Scope The configurations detailed in this guide are consistent with EventTracker Enterprise version 8.x and later, HAProxy 1.7.5 and later.

Audience Administrators who are responsible for monitoring HAProxy which are running the operating system using EventTracker Manager.

The information contained in this document represents the current view of EventTracker. on the issues discussed as of the date of publication. Because EventTracker must respond to changing market conditions, it should not be interpreted to be a commitment on the part of EventTracker, and EventTracker cannot guarantee the accuracy of any information presented after the date of publication.

This document is for informational purposes only. EventTracker MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from EventTracker, if its content is unaltered, nothing is added to the content and credit to EventTracker is provided.

EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from EventTracker, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred.

© 2017 EventTracker Security LLC. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

2

Integrate HAProxy

Table of Contents Abstract ........................................................................................................................................................................ 1

Scope ........................................................................................................................................................................ 1

Audience .................................................................................................................................................................. 1

HAProxy ........................................................................................................................................................................ 3

Prerequisites ................................................................................................................................................................ 3

Configure HAProxy to send syslog to EventTracker .................................................................................................. 3

EventTracker Knowledge Pack .................................................................................................................................... 4 Flex Reports ............................................................................................................................................................. 4

Import HAProxy knowledge pack into EventTracker ................................................................................................ 7 Token Templates ..................................................................................................................................................... 8

Flex Reports ............................................................................................................................................................. 9

Verify HAProxy knowledge pack in EventTracker.................................................................................................... 10 Token Template ..................................................................................................................................................... 10

Flex Reports ........................................................................................................................................................... 11

Create Flex Dashboards in EventTracker ................................................................................................................. 12 Schedule Reports ................................................................................................................................................... 12

Create Dashlets ...................................................................................................................................................... 14

Sample Flex Dashboards ....................................................................................................................................... 18

3

Integrate HAProxy

HAProxy HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Over the years, it has become the de-facto standard open source load balancer. Since it does not advertise itself, we only know it's used when the admins report it. Its mode of operation makes its integration into existing architectures very easy and riskless, while still offering the possibility not to expose fragile web servers to the net.

Prerequisites • EventTracker v8.x should be installed.

• HAProxy is known to reliably run on the following OS/Platforms:

Linux 2.4 on x86, x86_64, Alpha, Sparc, MIPS, PARISC

Linux 2.6 / 3.x on x86, x86_64, ARM, Sparc, PPC64

Solaris 8/9 on UltraSPARC 2 and 3

Solaris 10 on Opteron and UltraSPARC

FreeBSD 4.10 - 10 on x86

OpenBSD 3.1 to -current on i386, amd64, mac pc, alpha, sparc64 and VAX (check the ports)

AIX 5.1 - 5.3 on Power™ architecture

Configure HAProxy to send syslog to EventTracker To configure HAProxy to log in syslog,

• Edit the HAProxy server configuration file (/etc/haproxy/haproxy.cfg) and include the following lines: 1. global 2. log “EventTracker IP address” local0 3. option httplog

4

Integrate HAProxy

EventTracker Knowledge Pack Once logs are received into EventTracker, Categories and reports can be configured into EventTracker.

The following Knowledge Packs are available in EventTracker Enterprise to support Windows.

Flex Reports • HAProxy-Allowed traffic - This report provides details of all the acceptable traffic that is passed through

by the HA proxy server.

5

Integrate HAProxy

Logs Considered:

• HAProxy-Denied traffic - This report provides details on all the traffic that is denied by the HAProxy

server.

6

Integrate HAProxy

Logs Considered:

• HAProxy-Error connections - This report provides details on all the error connection between the backend and frontend server.

7

Integrate HAProxy

Logs Considered:

Import HAProxy knowledge pack into EventTracker NOTE: Import knowledge pack items in the following sequence:

• Token templates • Flex Reports

NOTE: Export knowledge pack items in the following sequence:

• Token templates • Flex Reports

1. Launch EventTracker Control Panel. 2. Double click Export Import Utility.

8

Integrate HAProxy

Figure 1

3. Click the Import tab.

Token Templates 1. Click the Admin menu, and then click Parsing rule. 2. Select Template tab, and then click on ‘Import’ option. 3. Click on Browse button.

Figure 2

4. Locate All HAProxy templates.ettd file, and then click the Open button.

Figure 3

9

Integrate HAProxy

5. Now select the check box and then click on ‘Import’ option. EventTracker displays success message.

Figure 4

6. Click on OK button.

Flex Reports 1. Click Reports option, and then click the browse button. 2. Locate the All HAProxy reports.etcrx file, and then click the Open button.

Figure 5

10

Integrate HAProxy

Figure 6

3. Click the Import button to import the scheduled reports. EventTracker displays success message.

Figure 7

Verify HAProxy knowledge pack in EventTracker Token Template 1. Logon to EventTracker Enterprise web interface. 2. Click the Admin menu, and then click Parsing Rules and click Template.

11

Integrate HAProxy

3. Click on HAProxy group option.

Figure 8

Flex Reports 1. In the EventTracker Enterprise web interface, click the Reports menu, and then select Configuration. 2. In Reports Configuration pane, select Defined option. 3. In search box enter ‘HAProxy, and then click the Search button.

EventTracker displays Flex reports of ‘HAProxy’.

12

Integrate HAProxy

Figure 9

Create Flex Dashboards in EventTracker NOTE: To configure the flex dashboards, schedule and generate the reports. Flex dashboard feature is available from EventTracker Enterprise v8.0.

Schedule Reports 1. Open EventTracker in browser and logon.

Figure 10

2. Navigate to Reports>Configuration.

3. Select HAProxy in report groups. Check Defined dialog box.

13

Integrate HAProxy

Figure 11

4. Click on ‘schedule’ to plan a report for later execution. 5. Click Next button to proceed. 6. In review page, check Persist data in EventVault Explorer option.

Figure 12

14

Integrate HAProxy

7. In next page, check column names to persist using PERSIST checkboxes beside them. Choose suitable Retention period.

Figure 13

8. Proceed to next step and click Schedule button. 9. Wait till the reports get generated.

Create Dashlets 1. Open EventTracker Enterprise in browser and logon.

15

Integrate HAProxy

Figure 14

2. Navigate to Dashboard>Flex. Flex Dashboard pane is shown.

Figure 15

3. Fill suitable title and description and click Save button. 4. Click to configure a new flex dashlet. Widget configuration pane is shown.

16

Integrate HAProxy

Figure 16

5. Locate earlier scheduled report in Data Source dropdown. 6. Select Chart Type from dropdown. 7. Select extent of data to be displayed in Duration dropdown. 8. Select computation type in Value Field Setting dropdown. 9. Select evaluation duration in As Of dropdown. 10. Select comparable values in X Axis with suitable label. 11. Select numeric values in Y Axis with suitable label. 12. Select comparable sequence in Legend. 13. Click Test button to evaluate. Evaluated chart is shown.

17

Integrate HAProxy

Figure 17

14. If satisfied, click Configure button.

Figure 18

15. Click ‘customize’ to locate and choose created dashlet. 16. Click to add dashlet to earlier created dashboard.

18

Integrate HAProxy

Sample Flex Dashboards • REPORT: HAProxy-Allowed traffic

WIDGET TITLE: HAProxy- Allowed traffic CHART TYPE: Stacked Column AXIS LABELS [X-AXIS]: Remote Uri Accessed LEGEND [SERIES]: Client IP Address

• REPORT: HAProxy-Denied traffic

WIDGET TITLE: HAProxy-Denied traffic CHART TYPE: Stacked column AXIS LABELS [X-AXIS]: Client IP Address LEGEND[SERIES]: Uri Accessed

19

Integrate HAProxy

• REPORT: HAProxy-Error connections WIDGET TITLE: HAProxy-Error connections CHART TYPE: Stacked Column AXIS LABELS [X-AXIS]: Error Message LEGEND[SERIES]: Client IP Address